/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

3 votes179 views1 answer
Bash display items in array
Shell/Bash
4 votes211 views3 answers
Kill screen sessions
Shell/Bash
0 vote180 views1 answer
Sound output raspberry pi
Shell/Bash
4 votes188 views1 answer
Checkout untracked files
Shell/Bash
0 vote194 views1 answer
Install gearman di linux
Shell/Bash
0 vote200 views3 answers
Linux find partial name
Shell/Bash
0 vote213 views1 answer
Compressing files on cmd line using winrar
Shell/Bash
0 vote242 views2 answers
Ansible playbook omit tag
Shell/Bash
0 vote193 views1 answer
Piping commands 1
Shell/Bash
0 vote191 views1 answer
Make bootable usb stick with linux console dd
Shell/Bash